Jingle Thief - Rogue Device Registration from Morocco

nomit vyas@xoxo

•updated Jun 23, 2026•2•0•8

Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).